# Data Center Risk: 20% of CPS Assets Exposed to Attack

> Claroty research reveals 1 in 5 data center cyber-physical systems are exposed to the internet, creating risks for physical disruption and lateral movement.

- Published: 2026-07-30T10:27:18.000Z
- Severity: high
- Category: Threat Intel
- Tags: Claroty, Cyber Physical Systems, BMS, Data Center Security, OT Security
- Author: Runtime Rebel Intel
- Primary source: https://www.securityweek.com/1-in-5-data-center-assets-are-within-easy-reach-of-attackers/
- Canonical: https://runtimerebel.com/blog/data-center-risk-20-of-cps-assets-exposed-to-attack

## Key points

- Attackers can gain direct access to 20 percent of data center cyber-physical systems, risking critical infrastructure outages and physical damage.
- Affected systems include building management systems, power monitoring tools, and HVAC controllers within large-scale data center facilities.
- Defenders must implement strict network segmentation and disable internet exposure for all non-essential industrial control and monitoring hardware.

Recent research by Claroty has highlighted a significant security gap in critical infrastructure: approximately one in five cyber-physical systems (CPS) within major data center facilities are readily accessible to remote attackers. According to [SecurityWeek](https://www.securityweek.com/1-in-5-data-center-assets-are-within-easy-reach-of-attackers/), an analysis of 750,000 CPS assets across global data centers revealed that 20% of these critical components are either directly connected to the internet or reside on poorly segmented networks. This exposure represents a substantial [CVE](/glossary#cve) risk landscape, as many of these legacy systems were never designed with modern security protocols in mind.

The assets in question primarily include Building Management Systems (BMS), Electrical Power Monitoring Systems (EPMS), Uninterruptible Power Supplies (UPS), and Power Distribution Units (PDU). While these systems are essential for maintaining the uptime and environmental conditions of a data center, their compromise could lead to catastrophic physical outcomes, including equipment failure or intentional service disruption. Because these systems often run on proprietary or legacy hardware, they lack the native security features found in modern IT stacks.

## Securing Data Center Cyber-Physical Systems against Remote Exploitation

The primary challenge in securing data center cyber-physical systems lies in the convergence of Information Technology (IT) and Operational Technology (OT). Traditionally, OT systems operated in air-gapped environments. However, the demand for remote monitoring and real-time telemetry has pushed these systems onto IP-based networks. When these systems are not protected by a [Zero Trust](/glossary#zero-trust) architecture, they become low-hanging fruit for threat actors seeking to disrupt operations.

Claroty's research indicates that the exposure is not merely theoretical. Attackers can leverage simple search tools to find exposed industrial controllers. Once access is gained to a BMS or HVAC system, a sophisticated [APT](/glossary#apt) could perform [Lateral Movement](/glossary#lateral-movement) to reach more sensitive parts of the infrastructure, such as management consoles or even the server hardware itself. The lack of [EDR](/glossary#edr) capabilities on these specialized devices makes detection significantly harder for a standard [SOC](/glossary#soc). This visibility gap means an intruder could persist within the cooling or power systems for extended periods without detection.

### How to Identify Exposed Data Center Assets and Vulnerabilities

Organizations must adopt a proactive stance by performing regular external scans to see what an attacker sees. Identifying exposed data center assets requires a combination of network discovery tools and specialized industrial protocol analyzers. Many of the vulnerabilities found in these environments are not related to a specific [CVE](/glossary#cve) but rather to configuration errors, such as the use of default credentials or unencrypted communication protocols like Modbus or BACnet. These protocols often lack authentication, allowing anyone who can reach the IP address to send commands to the hardware.

Furthermore, the presence of [Ransomware](/glossary#ransomware) in data center environments is no longer limited to the software layer. An attacker could theoretically hold the physical environment of the data center hostage by manipulating cooling systems (HVAC) to induce thermal shutdowns. This type of physical [DDoS](/glossary#ddos) attack can be just as damaging as a traditional network-based assault, as it forces the physical shutdown of servers to prevent hardware melting, leading to massive service outages.

## Actionable Recommendations for Infrastructure Defenders

To mitigate these risks, defenders must prioritize the following strategies:

*   **Strict Network Segmentation**: Ensure that all OT and CPS traffic is isolated from the corporate IT network and the public internet. Use industrial firewalls to enforce granular access control lists.
*   **Disable Insecure Protocols**: Where possible, transition away from clear-text industrial protocols and implement encrypted alternatives or secure gateways.
*   **Continuous Monitoring**: Integrate OT-specific security tools with existing [SIEM](/glossary#siem) platforms to gain visibility into anomalous traffic patterns within the BMS and EPMS layers.
*   **Credential Hygiene**: Audit all CPS devices for default or weak credentials and enforce strong, unique passwords, ideally managed through a centralized identity platform.

By addressing these foundational gaps, organizations can significantly reduce the [TTP](/glossary#ttp) options available to attackers and ensure the physical resilience of their digital operations against both opportunistic and targeted threats.

**Related:** [OT Security: Legacy System Vulnerabilities in Critical Infrastructure](/blog/ot-security-legacy-system-vulnerabilities-in-critical-infrastructure), [CVE-2026-4293: Kieback & Peter DDC XSS — Mitigate Building Controller Risks](/blog/cve-2026-4293-kieback-peter-ddc-xss-mitigate-building-controller-risks)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/data-center-risk-20-of-cps-assets-exposed-to-attack